Devices sprout ears: What do Alexa and Siri mean for privacy?

The Echo is taking the US by storm, with Google Home hot on its tracks. What are the privacy risks of having an always-listening digital assistant in your home?

Between your laptop, smartphone, smart TV, and perhaps a virtual assistant, how many microphones are in your home?

The number of households with a hands-free assistant is growing by millions each year, but their convenience may come at a price. With law enforcement already using smart-device collected data as evidence, digital privacy rights are becoming more important – and less understood – than ever, as the rapid pace of technological advancement and shifting attitudes towards privacy keep the topic murky.

The home assistant Echo was Amazon’s best-selling product last holiday season, with Forrester Research suggesting 6 million sales in 2016 alone. The Echo family of devices are all variations on the theme of a smart speaker that can listen to, understand, and respond to voice commands for everything from unit conversions, to spelling, to shopping. Like Siri’s implementation in recent iOS devices, a large part of the convenience is how the device is always listening, so you don’t have to put down what you’re doing and find your phone to get an answer.

But some worry there’s a fine line between always listening, and always recording. ACLU senior policy analyst Jay Stanley warns that “even the most remote threat of surveillance” can cast “self-consciousness and chilling effects ... over otherwise freewheeling private conversations".

We all act differently when we think we’re in private. The question is, are we truly alone when we’re with our devices?

In the case of Siri, the answer seems to be yes, mostly. There’s no user-accessible record of your previous queries because Apple associates them with a random ID number, rather than your email address or iCloud account. After six months, both are deleted.

For the Echo, however, it’s more complicated. “The cost of the device is not the ultimate revenue for these companies – advertising and personal information are what's at the end of the rainbow for them,” explains Albert Gidari, the director of privacy at the Stanford Center for Internet and Society, in an email to the Christian Science Monitor.

As part of its quest to make ever more accurate recommendations and improve its voice recognition technology, Amazon maintains a database of your conversations with the Echo, which you can see and manage online. In addition, audio data is encrypted when it enters and leaves your home, to minimize the risk of interception by hackers.

Why ship the data off at all? Because the Echo and the iPhone are more ear than brain, and all the heavy-duty data crunching required for machines to understand human speech is done on far-away Amazon and Apple servers. The good news is, the ears themselves aren’t that smart. Beyond the wake commands of “Alexa” or “Hey Siri,” very little data is stored locally and the devices record no conversation unless they hear the wake phrase first.

Still, machine hearing is at an early phase of development, and mistakes open the door to eavesdropping. Mr. Stanley laid out a potential scenario for confusion:

“It's easy to see how a sentence such as “He was driving a Lexus in a way she said was dangerous” could be heard by an Echo as “Alexa: Sin away she said—was dangerous.” The constant potential for accidental recording means that users do not necessarily have complete control over what audio gets transmitted to the cloud.”

Mr. Gidari, however, is cautiously optimistic. “[T]hey designed [the Echo] well, but we are at version 1.0, so as the product evolves and Amazon and others develop, paying attention to privacy in that evolution will be important.”

The concern is more than just theoretical. Police in Bentonville, Ark. have already submitted a search warrant for “audio recordings, transcribed records, and other text records” from the Echo of 2015 murder suspect James Andrew Bates. Currently, the amount of data the police were able to extract from the Echo is unclear, and Amazon refused to turn over data from its servers beyond basic account information. Center for Democracy and Technology policy counsel Joseph Jerome commended Amazon for “going to bat for its users’ privacy to the fullest extent possible”, but warns that this case should be a wake-up call.

As Mr. Stanley described it, there are two opposing legal forces at work. On the defensive side, the Fourth Amendment establishes the “sanctity of the home,” which prevents law enforcement from an unjustified search of a house. On the offensive side, however, stands the “third-party doctrine,” which permits police to access information voluntarily shared with a third party such as your bank or phone company, even without a warrant.

With the purchase of an Echo, a user has voluntarily invited Amazon, a third party, into their home, creating a contradiction. To Stanley, the solution is clear: “The third-party doctrine must go.” Mr. Jerome agrees that the current state of the law is “ripe for reform.”

Even with the third-party doctrine, however, data collection isn’t exactly a free-for-all. Gidari suspects that it might be possible to get a wiretap in order to listen in on an Echo, but the Wiretap Act specifies that such eavesdropping be a measure of last resort, only after “normal investigative procedures have been tried and have failed or reasonably appear to be unlikely to succeed.”

While the law may benefit from clarification to reflect emerging communication technologies, Americans’ attitudes towards privacy are shifting to meet it halfway. Gidari sees home assistants as merely another step in this process. “With every new app or service, there are stories that engender initial fear but that gives way over time to widespread adoption because the benefit outweighs the risks and people trust the companies enough. Ask your father whether he could have envisioned using a service that mechanically scanned all his mail to deliver ads to him in return for free postage!”

In the end, Gidari’s message for Echo lovers is mostly optimistic. “Embrace the future! Seriously, I think the risk is overstated today, but everyone should watch the product evolution.”